
<!doctype html>
<html lang="en" class="no-js">
  <head>
    
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width,initial-scale=1">
      
      
      
      <link rel="icon" href="../../../../static/images/favicon.png">
      <meta name="generator" content="mkdocs-1.3.0, mkdocs-material-8.2.8">
    
    
      
        <title>关于 k8s/docker/containerd / runc / ctr / cgroups/namespaces 生产运维实操 - WL4G DOCS</title>
      
    
    
      <link rel="stylesheet" href="../../../../assets/stylesheets/main.644de097.min.css">
      
        
        <link rel="stylesheet" href="../../../../assets/stylesheets/palette.e6a45f82.min.css">
        
      
    
    
    
      
        
        
        <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
        <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback">
        <style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style>
      
    
    
      <link rel="stylesheet" href="../../../../static/css/util.css">
    
    <script>__md_scope=new URL("../../../..",location),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script>
    
      

    
    
  </head>
  
  
    
    
      
    
    
    
    
    <body dir="ltr" data-md-color-scheme="default" data-md-color-primary="" data-md-color-accent="">
  
    
    
      <script>var palette=__md_get("__palette");if(palette&&"object"==typeof palette.color)for(var key of Object.keys(palette.color))document.body.setAttribute("data-md-color-"+key,palette.color[key])</script>
    
    <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
    <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
    <label class="md-overlay" for="__drawer"></label>
    <div data-md-component="skip">
      
        
        <a href="#k8sdockercontainerd-runc-ctr-cgroupsnamespaces" class="md-skip">
          Skip to content
        </a>
      
    </div>
    <div data-md-component="announce">
      
    </div>
    
      <div data-md-component="outdated" hidden>
        <aside class="md-banner md-banner--warning">
          
        </aside>
      </div>
    
    
      

<header class="md-header" data-md-component="header">
  <nav class="md-header__inner md-grid" aria-label="Header">
    <a href="../../../.." title="WL4G DOCS" class="md-header__button md-logo" aria-label="WL4G DOCS" data-md-component="logo">
      
  <img src="../../../../static/images/mylogo.jpeg" alt="logo">

    </a>
    <label class="md-header__button md-icon" for="__drawer">
      <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3V6m0 5h18v2H3v-2m0 5h18v2H3v-2z"/></svg>
    </label>
    <div class="md-header__title" data-md-component="header-title">
      <div class="md-header__ellipsis">
        <div class="md-header__topic">
          <span class="md-ellipsis">
            WL4G DOCS
          </span>
        </div>
        <div class="md-header__topic" data-md-component="header-topic">
          <span class="md-ellipsis">
            
              关于 k8s/docker/containerd / runc / ctr / cgroups/namespaces 生产运维实操
            
          </span>
        </div>
      </div>
    </div>
    
      <form class="md-header__option" data-md-component="palette">
        
          
          
          <input class="md-option" data-md-color-media="(prefers-color-scheme: light)" data-md-color-scheme="default" data-md-color-primary="" data-md-color-accent=""  aria-label="Switch to dark mode"  type="radio" name="__palette" id="__palette_1">
          
            <label class="md-header__button md-icon" title="Switch to dark mode" for="__palette_2" hidden>
              <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6zm0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4zM7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3z"/></svg>
            </label>
          
        
          
          
          <input class="md-option" data-md-color-media="(prefers-color-scheme: dark)" data-md-color-scheme="slate" data-md-color-primary="" data-md-color-accent=""  aria-label="Switch to light mode"  type="radio" name="__palette" id="__palette_2">
          
            <label class="md-header__button md-icon" title="Switch to light mode" for="__palette_1" hidden>
              <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3z"/></svg>
            </label>
          
        
      </form>
    
    
      <div class="md-header__option">
        <div class="md-select">
          
          <button class="md-header__button md-icon" aria-label="Select language">
            <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="m12.87 15.07-2.54-2.51.03-.03A17.52 17.52 0 0 0 14.07 6H17V4h-7V2H8v2H1v2h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04M18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12m-2.62 7 1.62-4.33L19.12 17h-3.24z"/></svg>
          </button>
          <div class="md-select__inner">
            <ul class="md-select__list">
              
                <li class="md-select__item">
                  <a href="/en/" hreflang="en" class="md-select__link">
                    English
                  </a>
                </li>
                
                <li class="md-select__item">
                  <a href="/zh/" hreflang="zh" class="md-select__link">
                    简体中文
                  </a>
                </li>
                
            </ul>
          </div>
        </div>
      </div>
    
    
      <label class="md-header__button md-icon" for="__search">
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5z"/></svg>
      </label>
      <div class="md-search" data-md-component="search" role="dialog">
  <label class="md-search__overlay" for="__search"></label>
  <div class="md-search__inner" role="search">
    <form class="md-search__form" name="search">
      <input type="text" class="md-search__input" name="query" aria-label="Search" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" required>
      <label class="md-search__icon md-icon" for="__search">
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5z"/></svg>
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12z"/></svg>
      </label>
      <nav class="md-search__options" aria-label="Search">
        
        <button type="reset" class="md-search__icon md-icon" aria-label="Clear" tabindex="-1">
          <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12 19 6.41z"/></svg>
        </button>
      </nav>
      
        <div class="md-search__suggest" data-md-component="search-suggest"></div>
      
    </form>
    <div class="md-search__output">
      <div class="md-search__scrollwrap" data-md-scrollfix>
        <div class="md-search-result" data-md-component="search-result">
          <div class="md-search-result__meta">
            Initializing search
          </div>
          <ol class="md-search-result__list"></ol>
        </div>
      </div>
    </div>
  </div>
</div>
    
    
  </nav>
  
</header>
    
    <div class="md-container" data-md-component="container">
      
      
        
          
            
<nav class="md-tabs" aria-label="Tabs" data-md-component="tabs">
  <div class="md-tabs__inner md-grid">
    <ul class="md-tabs__list">
      
        
  
  


  
  
  
    <li class="md-tabs__item">
      <a href="../../../.." class="md-tabs__link">
        Getting Started
      </a>
    </li>
  

      
    </ul>
  </div>
</nav>
          
        
      
      <main class="md-main" data-md-component="main">
        <div class="md-main__inner md-grid">
          
            
              
              <div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">
                    

  


  

<nav class="md-nav md-nav--primary md-nav--lifted md-nav--integrated" aria-label="Navigation" data-md-level="0">
  <label class="md-nav__title" for="__drawer">
    <a href="../../../.." title="WL4G DOCS" class="md-nav__button md-logo" aria-label="WL4G DOCS" data-md-component="logo">
      
  <img src="../../../../static/images/mylogo.jpeg" alt="logo">

    </a>
    WL4G DOCS
  </label>
  
  <ul class="md-nav__list" data-md-scrollfix>
    
      
      
      

  
  
  
    
    <li class="md-nav__item md-nav__item--nested">
      
      
        <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_1" data-md-state="indeterminate" type="checkbox" id="__nav_1" checked>
      
      
      
      
        <label class="md-nav__link" for="__nav_1">
          Getting Started
          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" aria-label="Getting Started" data-md-level="1">
        <label class="md-nav__title" for="__nav_1">
          <span class="md-nav__icon md-icon"></span>
          Getting Started
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../.." class="md-nav__link">
        Introduction
      </a>
    </li>
  

            
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../../ABOUT_CN/" class="md-nav__link">
        About
      </a>
    </li>
  

            
          
        </ul>
      </nav>
    </li>
  

    
  </ul>
</nav>
                  </div>
                </div>
              </div>
            
            
          
          <div class="md-content" data-md-component="content">
            <article class="md-content__inner md-typeset">
              
                


<h1 id="k8sdockercontainerd-runc-ctr-cgroupsnamespaces">关于 k8s/docker/containerd / runc / ctr / cgroups/namespaces 生产运维实操<a class="headerlink" href="#k8sdockercontainerd-runc-ctr-cgroupsnamespaces" title="Permanent link">&para;</a></h1>
<h2 id="_1">背景<a class="headerlink" href="#_1" title="Permanent link">&para;</a></h2>
<p>相信刚开始使用 docker 或 cri-o / containerd 的童鞋都应该经常碰到过这样一个问题，如想查看某个容器的 IP 或运行的进程等资源，发现进入容器后都是 command not found，因为通常生产环境为了减少镜像尺寸都会使用如 alpine 这种裁剪版linux很多命令都被移除，那么如何优雅的查看容器里的资源呢？</p>
<h2 id="1-linux-namespaces">1. 第一部分: 关于 Linux namespaces 及与容器关联操作<a class="headerlink" href="#1-linux-namespaces" title="Permanent link">&para;</a></h2>
<h3 id="11-linux-namespaces">1.1 Linux namespaces 基础<a class="headerlink" href="#11-linux-namespaces" title="Permanent link">&para;</a></h3>
<p>最初是由 <a href="https://en.wikipedia.org/wiki/Borg_(cluster_manager)">Google Borg</a> 系统在linux上限制资源的需求而设计的的机制，发展到如今 linux kernel 标准的 CGroups subsystem 机制，以下关于 namespaces 相关基础：</p>
<table>
<thead>
<tr>
<th>Namespaces Type</th>
<th>系统调用参数</th>
<th>支持的内核版本</th>
</tr>
</thead>
<tbody>
<tr>
<td>Mount namespaces</td>
<td>CLONE_NEWNS</td>
<td>Linux 2.4.19+</td>
</tr>
<tr>
<td>UTS namespaces</td>
<td>CLONE_NEWUTS</td>
<td>Linux 2.4.19+</td>
</tr>
<tr>
<td>IPC namespaces</td>
<td>CLONE_NEWIPC</td>
<td>Linux 2.4.19+</td>
</tr>
<tr>
<td>PID namespaces</td>
<td>CLONE_NEWPID</td>
<td>Linux 2.6.24+</td>
</tr>
<tr>
<td>Network namespaces</td>
<td>CLONE_NEWNET</td>
<td>Linux 2.4.29+</td>
</tr>
<tr>
<td>User namespaces</td>
<td>CLONE_NEWUSER</td>
<td>Linux 3.8+</td>
</tr>
</tbody>
</table>
<ul>
<li>Mount: mount表空间隔离，配合chroot系统调用，使程序有自己的文件系统</li>
<li>UTS: hostname(本地主机名)和doaminname隔离，使应用有自己独立的主机名
假设分配UTS1、UTS2给2个进程P1、P2，那么P1看到的本地主机名H1，P2看到的本地主机名H2。放佛P1、P2是运行在2个不同的机器上一样。</li>
<li>IPC: 隔离进程间通讯</li>
<li>PID: 使程序包括子程序构造一个独立的程序集，最先创建的程序为1号pid</li>
<li>Network: 网络空间隔离，支行在此空间的程序拥有独立的网络栈。
一个进程属于什么Network命名空间，决定了运行在进程里的应用程序能看见什么网络端口。每个网络接口属于一个命名空间，但是可以从一个命名空间转移到另一个。每个容器都使用属于它自己的网络命名空间，因此每个容器技能看到它自己的一组网络接口。</li>
<li>User: 此空间下有独立的 uid/gid 系统，目前较新版本的 docker 貌似是使用与宿主机的 uid/gid 数字映射.</li>
</ul>
<blockquote>
<p><strong><em>因此一个容器拥有一组命名空间, 即: Mount1、UTS1、IPC1、PID1、Network1、User1 组合。</em></strong>
<strong><em>Namespaces 操作可以通过三个系统调用完成: <code>clone(),unshare(),setns()</code>, 默认情况下子进程继承新父进程的 namespaces。</em></strong></p>
</blockquote>
<h3 id="12">1.2 如何从宿主机内核层面查看某个容器的网络、主机等信息?<a class="headerlink" href="#12" title="Permanent link">&para;</a></h3>
<p>因无 <code>ifconfig</code> 等命令，我们可以直接进入容器所属相应的 namespace 来查看资源情况:（以查看 docker 中 wordpress 容器的 IP 和 Hostname 为例）</p>
<h3 id="13-ip-net-hostname-uts">1.3 查看容器 IP (net 命名空间) 和 Hostname (UTS 命名空间)<a class="headerlink" href="#13-ip-net-hostname-uts" title="Permanent link">&para;</a></h3>
<div class="highlight"><pre><span></span><code><a id="__codelineno-0-1" name="__codelineno-0-1"></a><a href="#__codelineno-0-1"><span class="linenos" data-linenos=" 1 "></span></a><span class="c1"># 失败示例：尝试在 wordpress 容器中使用 ifconfig 命令查看 ip</span>
<a id="__codelineno-0-2" name="__codelineno-0-2"></a><a href="#__codelineno-0-2"><span class="linenos" data-linenos=" 2 "></span></a>sudo docker <span class="nb">exec</span> -it wordpress bash -c <span class="s2">&quot;ifconfig&quot;</span>
<a id="__codelineno-0-3" name="__codelineno-0-3"></a><a href="#__codelineno-0-3"><span class="linenos" data-linenos=" 3 "></span></a>bash: ifconfig: <span class="nb">command</span> not found
<a id="__codelineno-0-4" name="__codelineno-0-4"></a><a href="#__codelineno-0-4"><span class="linenos" data-linenos=" 4 "></span></a>
<a id="__codelineno-0-5" name="__codelineno-0-5"></a><a href="#__codelineno-0-5"><span class="linenos" data-linenos=" 5 "></span></a><span class="c1"># 直接通过 namespace 查看</span>
<a id="__codelineno-0-6" name="__codelineno-0-6"></a><a href="#__codelineno-0-6"><span class="linenos" data-linenos=" 6 "></span></a><span class="c1"># 先找到 wordpress 容器的 pid</span>
<a id="__codelineno-0-7" name="__codelineno-0-7"></a><a href="#__codelineno-0-7"><span class="linenos" data-linenos=" 7 "></span></a>sudo docker inspect wordpress <span class="p">|</span> grep -i pid
<a id="__codelineno-0-8" name="__codelineno-0-8"></a><a href="#__codelineno-0-8"><span class="linenos" data-linenos=" 8 "></span></a>            <span class="s2">&quot;Pid&quot;</span>: <span class="m">1609</span>,
<a id="__codelineno-0-9" name="__codelineno-0-9"></a><a href="#__codelineno-0-9"><span class="linenos" data-linenos=" 9 "></span></a>            <span class="s2">&quot;PidMode&quot;</span>: <span class="s2">&quot;&quot;</span>,
<a id="__codelineno-0-10" name="__codelineno-0-10"></a><a href="#__codelineno-0-10"><span class="linenos" data-linenos="10 "></span></a>            <span class="s2">&quot;PidsLimit&quot;</span>: null,
<a id="__codelineno-0-11" name="__codelineno-0-11"></a><a href="#__codelineno-0-11"><span class="linenos" data-linenos="11 "></span></a>
<a id="__codelineno-0-12" name="__codelineno-0-12"></a><a href="#__codelineno-0-12"><span class="linenos" data-linenos="12 "></span></a><span class="c1"># 查看所属 net-namespace 的 IP</span>
<a id="__codelineno-0-13" name="__codelineno-0-13"></a><a href="#__codelineno-0-13"><span class="linenos" data-linenos="13 "></span></a>sudo nsenter -t <span class="m">1609</span> -n ifconfig
<a id="__codelineno-0-14" name="__codelineno-0-14"></a><a href="#__codelineno-0-14"><span class="linenos" data-linenos="14 "></span></a>eth0: <span class="nv">flags</span><span class="o">=</span><span class="m">4163</span>&lt;UP,BROADCAST,RUNNING,MULTICAST&gt;  mtu <span class="m">1500</span>
<a id="__codelineno-0-15" name="__codelineno-0-15"></a><a href="#__codelineno-0-15"><span class="linenos" data-linenos="15 "></span></a>        inet <span class="m">172</span>.17.0.2  netmask <span class="m">255</span>.255.0.0  broadcast <span class="m">172</span>.17.255.255
<a id="__codelineno-0-16" name="__codelineno-0-16"></a><a href="#__codelineno-0-16"><span class="linenos" data-linenos="16 "></span></a>        ether <span class="m">02</span>:42:ac:11:00:02  txqueuelen <span class="m">0</span>  <span class="o">(</span>Ethernet<span class="o">)</span>
<a id="__codelineno-0-17" name="__codelineno-0-17"></a><a href="#__codelineno-0-17"><span class="linenos" data-linenos="17 "></span></a>        RX packets <span class="m">97251</span>  bytes <span class="m">217684487</span> <span class="o">(</span><span class="m">207</span>.6 MiB<span class="o">)</span>
<a id="__codelineno-0-18" name="__codelineno-0-18"></a><a href="#__codelineno-0-18"><span class="linenos" data-linenos="18 "></span></a>        RX errors <span class="m">0</span>  dropped <span class="m">0</span>  overruns <span class="m">0</span>  frame <span class="m">0</span>
<a id="__codelineno-0-19" name="__codelineno-0-19"></a><a href="#__codelineno-0-19"><span class="linenos" data-linenos="19 "></span></a>        TX packets <span class="m">107996</span>  bytes <span class="m">51322784</span> <span class="o">(</span><span class="m">48</span>.9 MiB<span class="o">)</span>
<a id="__codelineno-0-20" name="__codelineno-0-20"></a><a href="#__codelineno-0-20"><span class="linenos" data-linenos="20 "></span></a>        TX errors <span class="m">0</span>  dropped <span class="m">0</span> overruns <span class="m">0</span>  carrier <span class="m">0</span>  collisions <span class="m">0</span>
<a id="__codelineno-0-21" name="__codelineno-0-21"></a><a href="#__codelineno-0-21"><span class="linenos" data-linenos="21 "></span></a>
<a id="__codelineno-0-22" name="__codelineno-0-22"></a><a href="#__codelineno-0-22"><span class="linenos" data-linenos="22 "></span></a>lo: <span class="nv">flags</span><span class="o">=</span><span class="m">73</span>&lt;UP,LOOPBACK,RUNNING&gt;  mtu <span class="m">65536</span>
<a id="__codelineno-0-23" name="__codelineno-0-23"></a><a href="#__codelineno-0-23"><span class="linenos" data-linenos="23 "></span></a>        inet <span class="m">127</span>.0.0.1  netmask <span class="m">255</span>.0.0.0
<a id="__codelineno-0-24" name="__codelineno-0-24"></a><a href="#__codelineno-0-24"><span class="linenos" data-linenos="24 "></span></a>        loop  txqueuelen <span class="m">1000</span>  <span class="o">(</span>Local Loopback<span class="o">)</span>
<a id="__codelineno-0-25" name="__codelineno-0-25"></a><a href="#__codelineno-0-25"><span class="linenos" data-linenos="25 "></span></a>        RX packets <span class="m">0</span>  bytes <span class="m">0</span> <span class="o">(</span><span class="m">0</span>.0 B<span class="o">)</span>
<a id="__codelineno-0-26" name="__codelineno-0-26"></a><a href="#__codelineno-0-26"><span class="linenos" data-linenos="26 "></span></a>        RX errors <span class="m">0</span>  dropped <span class="m">0</span>  overruns <span class="m">0</span>  frame <span class="m">0</span>
<a id="__codelineno-0-27" name="__codelineno-0-27"></a><a href="#__codelineno-0-27"><span class="linenos" data-linenos="27 "></span></a>        TX packets <span class="m">0</span>  bytes <span class="m">0</span> <span class="o">(</span><span class="m">0</span>.0 B<span class="o">)</span>
<a id="__codelineno-0-28" name="__codelineno-0-28"></a><a href="#__codelineno-0-28"><span class="linenos" data-linenos="28 "></span></a>        TX errors <span class="m">0</span>  dropped <span class="m">0</span> overruns <span class="m">0</span>  carrier <span class="m">0</span>  collisions <span class="m">0</span>
<a id="__codelineno-0-29" name="__codelineno-0-29"></a><a href="#__codelineno-0-29"><span class="linenos" data-linenos="29 "></span></a>
<a id="__codelineno-0-30" name="__codelineno-0-30"></a><a href="#__codelineno-0-30"><span class="linenos" data-linenos="30 "></span></a><span class="c1"># 查看容器主机名 (uts 命名空间)</span>
<a id="__codelineno-0-31" name="__codelineno-0-31"></a><a href="#__codelineno-0-31"><span class="linenos" data-linenos="31 "></span></a>sudo nsenter -t <span class="m">1609</span> -u hostname
<a id="__codelineno-0-32" name="__codelineno-0-32"></a><a href="#__codelineno-0-32"><span class="linenos" data-linenos="32 "></span></a>wordpress-1
</code></pre></div>
<blockquote>
<p>使用 <code>nsenter</code> 命令等价于进入容器执行命令, 即 <code>docker exec -it canal-server bash -c "ifconfig"</code>, 以上操作只进入命名空间，但不使用该命名空间的 net 和 mnt 命名空间 (不使用 mnt 命名空间的好处是可以使用宿主机的命令行工具)</p>
</blockquote>
<h3 id="14-13">1.4 (扩展知识) 接上面 <a href="#1.3">1.3</a><a class="headerlink" href="#14-13" title="Permanent link">&para;</a></h3>
<p>通过下面例子理解一下其实 container 相比 VM 实现更加轻量的原因就是 <a href="https://zsnmwy.notion.site/How-Container-To-Use-Host-Kernel-537f533d1d94471a8e881605030ea4a9#e0eec90df25d453eb01131ffcdf2f61c"><strong><em>共享 kernel</em></strong></a>，本质上不同的容器就只是不同的父子 PID 而已。</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-1-1" name="__codelineno-1-1"></a><a href="#__codelineno-1-1"><span class="linenos" data-linenos=" 1 "></span></a><span class="c1"># 在宿主机上查看该容器的 PID (该容器 NetworkMode 为: bridge)</span>
<a id="__codelineno-1-2" name="__codelineno-1-2"></a><a href="#__codelineno-1-2"><span class="linenos" data-linenos=" 2 "></span></a>ps -ef<span class="p">|</span>grep <span class="m">1609</span>
<a id="__codelineno-1-3" name="__codelineno-1-3"></a><a href="#__codelineno-1-3"><span class="linenos" data-linenos=" 3 "></span></a>root        <span class="m">1609</span>    <span class="m">1588</span>  <span class="m">0</span> Sep30 ?        <span class="m">00</span>:00:24 apache2 -DFOREGROUND
<a id="__codelineno-1-4" name="__codelineno-1-4"></a><a href="#__codelineno-1-4"><span class="linenos" data-linenos=" 4 "></span></a><span class="m">33</span>          <span class="m">1691</span>    <span class="m">1609</span>  <span class="m">0</span> Sep30 ?        <span class="m">00</span>:00:13 apache2 -DFOREGROUND
<a id="__codelineno-1-5" name="__codelineno-1-5"></a><a href="#__codelineno-1-5"><span class="linenos" data-linenos=" 5 "></span></a><span class="m">33</span>          <span class="m">1692</span>    <span class="m">1609</span>  <span class="m">0</span> Sep30 ?        <span class="m">00</span>:00:15 apache2 -DFOREGROUND
<a id="__codelineno-1-6" name="__codelineno-1-6"></a><a href="#__codelineno-1-6"><span class="linenos" data-linenos=" 6 "></span></a><span class="m">33</span>          <span class="m">1693</span>    <span class="m">1609</span>  <span class="m">0</span> Sep30 ?        <span class="m">00</span>:00:13 apache2 -DFOREGROUND
<a id="__codelineno-1-7" name="__codelineno-1-7"></a><a href="#__codelineno-1-7"><span class="linenos" data-linenos=" 7 "></span></a><span class="m">33</span>          <span class="m">1694</span>    <span class="m">1609</span>  <span class="m">0</span> Sep30 ?        <span class="m">00</span>:00:13 apache2 -DFOREGROUND
<a id="__codelineno-1-8" name="__codelineno-1-8"></a><a href="#__codelineno-1-8"><span class="linenos" data-linenos=" 8 "></span></a><span class="m">33</span>          <span class="m">1695</span>    <span class="m">1609</span>  <span class="m">0</span> Sep30 ?        <span class="m">00</span>:00:14 apache2 -DFOREGROUND
<a id="__codelineno-1-9" name="__codelineno-1-9"></a><a href="#__codelineno-1-9"><span class="linenos" data-linenos=" 9 "></span></a><span class="m">33</span>         <span class="m">11955</span>    <span class="m">1609</span>  <span class="m">0</span> Sep30 ?        <span class="m">00</span>:00:13 apache2 -DFOREGROUND
<a id="__codelineno-1-10" name="__codelineno-1-10"></a><a href="#__codelineno-1-10"><span class="linenos" data-linenos="10 "></span></a>root      <span class="m">771644</span>  <span class="m">764660</span>  <span class="m">0</span> <span class="m">17</span>:06 pts/0    <span class="m">00</span>:00:00 grep --color<span class="o">=</span>auto <span class="m">1609</span>
<a id="__codelineno-1-11" name="__codelineno-1-11"></a><a href="#__codelineno-1-11"><span class="linenos" data-linenos="11 "></span></a><span class="m">33</span>       <span class="m">1964767</span>    <span class="m">1609</span>  <span class="m">0</span> Oct08 ?        <span class="m">00</span>:00:06 apache2 -DFOREGROUND
<a id="__codelineno-1-12" name="__codelineno-1-12"></a><a href="#__codelineno-1-12"><span class="linenos" data-linenos="12 "></span></a><span class="m">33</span>       <span class="m">2316703</span>    <span class="m">1609</span>  <span class="m">0</span> Oct03 ?        <span class="m">00</span>:00:10 apache2 -DFOREGROUND
<a id="__codelineno-1-13" name="__codelineno-1-13"></a><a href="#__codelineno-1-13"><span class="linenos" data-linenos="13 "></span></a><span class="m">33</span>       <span class="m">2890263</span>    <span class="m">1609</span>  <span class="m">0</span> Oct04 ?        <span class="m">00</span>:00:10 apache2 -DFOREGROUND
<a id="__codelineno-1-14" name="__codelineno-1-14"></a><a href="#__codelineno-1-14"><span class="linenos" data-linenos="14 "></span></a><span class="m">33</span>       <span class="m">3562943</span>    <span class="m">1609</span>  <span class="m">0</span> Oct10 ?        <span class="m">00</span>:00:04 apache2 -DFOREGROUND
<a id="__codelineno-1-15" name="__codelineno-1-15"></a><a href="#__codelineno-1-15"><span class="linenos" data-linenos="15 "></span></a>
<a id="__codelineno-1-16" name="__codelineno-1-16"></a><a href="#__codelineno-1-16"><span class="linenos" data-linenos="16 "></span></a><span class="c1"># 再在宿主机查看父进程</span>
<a id="__codelineno-1-17" name="__codelineno-1-17"></a><a href="#__codelineno-1-17"><span class="linenos" data-linenos="17 "></span></a>ps -ef<span class="p">|</span>grep <span class="m">1588</span>
<a id="__codelineno-1-18" name="__codelineno-1-18"></a><a href="#__codelineno-1-18"><span class="linenos" data-linenos="18 "></span></a>root        <span class="m">1588</span>       <span class="m">1</span>  <span class="m">0</span> Sep30 ?        <span class="m">00</span>:00:30 /usr/lib/docker-current/containerd-shim-runc-v2 -namespace moby -id aefcf5a28fb3db7057ca1b59b489255024e333eedb497058e5163a109ea2cbc9 -address /run/containerd/containerd.sock
<a id="__codelineno-1-19" name="__codelineno-1-19"></a><a href="#__codelineno-1-19"><span class="linenos" data-linenos="19 "></span></a>root        <span class="m">1609</span>    <span class="m">1588</span>  <span class="m">0</span> Sep30 ?        <span class="m">00</span>:00:24 apache2 -DFOREGROUND
<a id="__codelineno-1-20" name="__codelineno-1-20"></a><a href="#__codelineno-1-20"><span class="linenos" data-linenos="20 "></span></a>root      <span class="m">771682</span>  <span class="m">764660</span>  <span class="m">0</span> <span class="m">17</span>:06 pts/0    <span class="m">00</span>:00:00 grep --color<span class="o">=</span>auto <span class="m">1588</span>
</code></pre></div>
<p>通过以上操作，发现了什么？</p>
<ul>
<li>a. 本质上不同的容器就只是不同的父子 PID 而已。</li>
<li>b. 解释了有些同学：升级 docker 会影响正在运行的容器吗？ --- 不会。原因：是因为调用过程是 docker --(rest)--&gt; dockerd --(grpc)--&gt; containerd --(ipc)--&gt; containerd-shim-runc-v2 --(ipc)--&gt; runc，其中页可以看到 1588 的父进程是 1。</li>
</ul>
<h3 id="15-java-root">1.5 查看容器里所有 java 进程 (以容器 root 权限执行)，然后找到某进程监听的端口<a class="headerlink" href="#15-java-root" title="Permanent link">&para;</a></h3>
<div class="highlight"><pre><span></span><code><a id="__codelineno-2-1" name="__codelineno-2-1"></a><a href="#__codelineno-2-1"><span class="linenos" data-linenos=" 1 "></span></a><span class="c1"># a. 找到容器在宿主机上的 PID</span>
<a id="__codelineno-2-2" name="__codelineno-2-2"></a><a href="#__codelineno-2-2"><span class="linenos" data-linenos=" 2 "></span></a>docker inspect canal-admin <span class="p">|</span> grep -i pid
<a id="__codelineno-2-3" name="__codelineno-2-3"></a><a href="#__codelineno-2-3"><span class="linenos" data-linenos=" 3 "></span></a>            <span class="s2">&quot;Pid&quot;</span>: <span class="m">6196</span>,
<a id="__codelineno-2-4" name="__codelineno-2-4"></a><a href="#__codelineno-2-4"><span class="linenos" data-linenos=" 4 "></span></a>            <span class="s2">&quot;PidMode&quot;</span>: <span class="s2">&quot;&quot;</span>,
<a id="__codelineno-2-5" name="__codelineno-2-5"></a><a href="#__codelineno-2-5"><span class="linenos" data-linenos=" 5 "></span></a>            <span class="s2">&quot;PidsLimit&quot;</span>: null,
<a id="__codelineno-2-6" name="__codelineno-2-6"></a><a href="#__codelineno-2-6"><span class="linenos" data-linenos=" 6 "></span></a>
<a id="__codelineno-2-7" name="__codelineno-2-7"></a><a href="#__codelineno-2-7"><span class="linenos" data-linenos=" 7 "></span></a><span class="c1"># b. 进入 6196 的 pid-namespace，然后以 root 用户执行 jps 命令</span>
<a id="__codelineno-2-8" name="__codelineno-2-8"></a><a href="#__codelineno-2-8"><span class="linenos" data-linenos=" 8 "></span></a>sudo nsenter -t <span class="m">6196</span> --pid -r jps
<a id="__codelineno-2-9" name="__codelineno-2-9"></a><a href="#__codelineno-2-9"><span class="linenos" data-linenos=" 9 "></span></a><span class="m">99</span> CanalAdminApplication
<a id="__codelineno-2-10" name="__codelineno-2-10"></a><a href="#__codelineno-2-10"><span class="linenos" data-linenos="10 "></span></a><span class="m">1508</span> Jps
<a id="__codelineno-2-11" name="__codelineno-2-11"></a><a href="#__codelineno-2-11"><span class="linenos" data-linenos="11 "></span></a>
<a id="__codelineno-2-12" name="__codelineno-2-12"></a><a href="#__codelineno-2-12"><span class="linenos" data-linenos="12 "></span></a><span class="c1"># c. 查看该容器的 net-namespace ，其中进程号为 99 的监听端口</span>
<a id="__codelineno-2-13" name="__codelineno-2-13"></a><a href="#__codelineno-2-13"><span class="linenos" data-linenos="13 "></span></a>sudo nsenter -t <span class="m">6196</span> --net -r ss -nlpt <span class="p">|</span> grep <span class="m">99</span>
<a id="__codelineno-2-14" name="__codelineno-2-14"></a><a href="#__codelineno-2-14"><span class="linenos" data-linenos="14 "></span></a>LISTEN     <span class="m">0</span>      <span class="m">100</span>                       *:8089                     *:*      users:<span class="o">((</span><span class="s2">&quot;java&quot;</span>,99,106<span class="o">))</span>
<a id="__codelineno-2-15" name="__codelineno-2-15"></a><a href="#__codelineno-2-15"><span class="linenos" data-linenos="15 "></span></a>LISTEN     <span class="m">0</span>      <span class="m">50</span>                        *:9990                     *:*
</code></pre></div>
<h3 id="16-lsns">1.6 关于 <code>lsns</code> 基本操作<a class="headerlink" href="#16-lsns" title="Permanent link">&para;</a></h3>
<ul>
<li>查看所有 ns</li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-3-1" name="__codelineno-3-1"></a><a href="#__codelineno-3-1"><span class="linenos" data-linenos=" 1 "></span></a>sudo lsns
<a id="__codelineno-3-2" name="__codelineno-3-2"></a><a href="#__codelineno-3-2"><span class="linenos" data-linenos=" 2 "></span></a>        NS TYPE  NPROCS   PID USER   COMMAND
<a id="__codelineno-3-3" name="__codelineno-3-3"></a><a href="#__codelineno-3-3"><span class="linenos" data-linenos=" 3 "></span></a><span class="m">4026531836</span> pid      <span class="m">317</span>     <span class="m">1</span> root   /usr/lib/systemd/systemd --switched-root --system --deserialize <span class="m">22</span>
<a id="__codelineno-3-4" name="__codelineno-3-4"></a><a href="#__codelineno-3-4"><span class="linenos" data-linenos=" 4 "></span></a><span class="m">4026531837</span> user     <span class="m">318</span>     <span class="m">1</span> root   /usr/lib/systemd/systemd --switched-root --system --deserialize <span class="m">22</span>
<a id="__codelineno-3-5" name="__codelineno-3-5"></a><a href="#__codelineno-3-5"><span class="linenos" data-linenos=" 5 "></span></a><span class="m">4026531838</span> uts      <span class="m">317</span>     <span class="m">1</span> root   /usr/lib/systemd/systemd --switched-root --system --deserialize <span class="m">22</span>
<a id="__codelineno-3-6" name="__codelineno-3-6"></a><a href="#__codelineno-3-6"><span class="linenos" data-linenos=" 6 "></span></a><span class="m">4026531839</span> ipc      <span class="m">317</span>     <span class="m">1</span> root   /usr/lib/systemd/systemd --switched-root --system --deserialize <span class="m">22</span>
<a id="__codelineno-3-7" name="__codelineno-3-7"></a><a href="#__codelineno-3-7"><span class="linenos" data-linenos=" 7 "></span></a><span class="m">4026531856</span> mnt        <span class="m">1</span>    <span class="m">91</span> root   kdevtmpfs
<a id="__codelineno-3-8" name="__codelineno-3-8"></a><a href="#__codelineno-3-8"><span class="linenos" data-linenos=" 8 "></span></a><span class="m">4026531956</span> net      <span class="m">317</span>     <span class="m">1</span> root   /usr/lib/systemd/systemd --switched-root --system --deserialize <span class="m">22</span>
<a id="__codelineno-3-9" name="__codelineno-3-9"></a><a href="#__codelineno-3-9"><span class="linenos" data-linenos=" 9 "></span></a><span class="m">4026532215</span> mnt        <span class="m">1</span>  <span class="m">5127</span> chrony /usr/sbin/chronyd
<a id="__codelineno-3-10" name="__codelineno-3-10"></a><a href="#__codelineno-3-10"><span class="linenos" data-linenos="10 "></span></a><span class="m">4026532216</span> mnt        <span class="m">2</span>  <span class="m">5120</span> root   /usr/sbin/NetworkManager --no-daemon
<a id="__codelineno-3-11" name="__codelineno-3-11"></a><a href="#__codelineno-3-11"><span class="linenos" data-linenos="11 "></span></a><span class="m">4026532219</span> mnt        <span class="m">1</span>  <span class="m">6264</span> root   /usr/bin/simple
<a id="__codelineno-3-12" name="__codelineno-3-12"></a><a href="#__codelineno-3-12"><span class="linenos" data-linenos="12 "></span></a>....
</code></pre></div>
<ul>
<li>查看 proc 文件系统查看 ns</li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-4-1" name="__codelineno-4-1"></a><a href="#__codelineno-4-1"><span class="linenos" data-linenos=" 1 "></span></a>sudo ls -l /proc/*/ns/ <span class="p">|</span>awk <span class="s1">&#39;{print $11}&#39;</span> <span class="p">|</span>sort -u
<a id="__codelineno-4-2" name="__codelineno-4-2"></a><a href="#__codelineno-4-2"><span class="linenos" data-linenos=" 2 "></span></a>ipc:<span class="o">[</span><span class="m">4026531839</span><span class="o">]</span>
<a id="__codelineno-4-3" name="__codelineno-4-3"></a><a href="#__codelineno-4-3"><span class="linenos" data-linenos=" 3 "></span></a>ipc:<span class="o">[</span><span class="m">4026532221</span><span class="o">]</span>
<a id="__codelineno-4-4" name="__codelineno-4-4"></a><a href="#__codelineno-4-4"><span class="linenos" data-linenos=" 4 "></span></a>mnt:<span class="o">[</span><span class="m">4026531840</span><span class="o">]</span>
<a id="__codelineno-4-5" name="__codelineno-4-5"></a><a href="#__codelineno-4-5"><span class="linenos" data-linenos=" 5 "></span></a>mnt:<span class="o">[</span><span class="m">4026531856</span><span class="o">]</span>
<a id="__codelineno-4-6" name="__codelineno-4-6"></a><a href="#__codelineno-4-6"><span class="linenos" data-linenos=" 6 "></span></a>mnt:<span class="o">[</span><span class="m">4026532215</span><span class="o">]</span>
<a id="__codelineno-4-7" name="__codelineno-4-7"></a><a href="#__codelineno-4-7"><span class="linenos" data-linenos=" 7 "></span></a>mnt:<span class="o">[</span><span class="m">4026532216</span><span class="o">]</span>
<a id="__codelineno-4-8" name="__codelineno-4-8"></a><a href="#__codelineno-4-8"><span class="linenos" data-linenos=" 8 "></span></a>mnt:<span class="o">[</span><span class="m">4026532219</span><span class="o">]</span>
<a id="__codelineno-4-9" name="__codelineno-4-9"></a><a href="#__codelineno-4-9"><span class="linenos" data-linenos=" 9 "></span></a>mnt:<span class="o">[</span><span class="m">4026532281</span><span class="o">]</span>
<a id="__codelineno-4-10" name="__codelineno-4-10"></a><a href="#__codelineno-4-10"><span class="linenos" data-linenos="10 "></span></a>net:<span class="o">[</span><span class="m">4026531956</span><span class="o">]</span>
<a id="__codelineno-4-11" name="__codelineno-4-11"></a><a href="#__codelineno-4-11"><span class="linenos" data-linenos="11 "></span></a>net:<span class="o">[</span><span class="m">4026532224</span><span class="o">]</span>
<a id="__codelineno-4-12" name="__codelineno-4-12"></a><a href="#__codelineno-4-12"><span class="linenos" data-linenos="12 "></span></a>....
</code></pre></div>
<h3 id="17-docker-namespaces">1.7 查看某个 docker 容器的 namespaces<a class="headerlink" href="#17-docker-namespaces" title="Permanent link">&para;</a></h3>
<div class="highlight"><pre><span></span><code><a id="__codelineno-5-1" name="__codelineno-5-1"></a><a href="#__codelineno-5-1"><span class="linenos" data-linenos=" 1 "></span></a> <span class="c1"># 查询容器对应在宿主机上的 pid</span>
<a id="__codelineno-5-2" name="__codelineno-5-2"></a><a href="#__codelineno-5-2"><span class="linenos" data-linenos=" 2 "></span></a>sudo docker inspect  -f <span class="s2">&quot;{{.State.Pid}}&quot;</span> 34b48c1d3093
<a id="__codelineno-5-3" name="__codelineno-5-3"></a><a href="#__codelineno-5-3"><span class="linenos" data-linenos=" 3 "></span></a><span class="m">10427</span>
<a id="__codelineno-5-4" name="__codelineno-5-4"></a><a href="#__codelineno-5-4"><span class="linenos" data-linenos=" 4 "></span></a>
<a id="__codelineno-5-5" name="__codelineno-5-5"></a><a href="#__codelineno-5-5"><span class="linenos" data-linenos=" 5 "></span></a>sudo ls -l /proc/10427/ns
<a id="__codelineno-5-6" name="__codelineno-5-6"></a><a href="#__codelineno-5-6"><span class="linenos" data-linenos=" 6 "></span></a>lrwxrwxrwx <span class="m">1</span> root root <span class="m">0</span> Dec <span class="m">11</span> <span class="m">16</span>:21 ipc -&gt; ipc:<span class="o">[</span><span class="m">4026533018</span><span class="o">]</span>
<a id="__codelineno-5-7" name="__codelineno-5-7"></a><a href="#__codelineno-5-7"><span class="linenos" data-linenos=" 7 "></span></a>lrwxrwxrwx <span class="m">1</span> root root <span class="m">0</span> Dec <span class="m">11</span> <span class="m">16</span>:21 mnt -&gt; mnt:<span class="o">[</span><span class="m">4026533016</span><span class="o">]</span>
<a id="__codelineno-5-8" name="__codelineno-5-8"></a><a href="#__codelineno-5-8"><span class="linenos" data-linenos=" 8 "></span></a>lrwxrwxrwx <span class="m">1</span> root root <span class="m">0</span> Dec <span class="m">11</span> <span class="m">16</span>:21 net -&gt; net:<span class="o">[</span><span class="m">4026531956</span><span class="o">]</span>
<a id="__codelineno-5-9" name="__codelineno-5-9"></a><a href="#__codelineno-5-9"><span class="linenos" data-linenos=" 9 "></span></a>lrwxrwxrwx <span class="m">1</span> root root <span class="m">0</span> Dec <span class="m">11</span> <span class="m">16</span>:21 pid -&gt; pid:<span class="o">[</span><span class="m">4026533019</span><span class="o">]</span>
<a id="__codelineno-5-10" name="__codelineno-5-10"></a><a href="#__codelineno-5-10"><span class="linenos" data-linenos="10 "></span></a>lrwxrwxrwx <span class="m">1</span> root root <span class="m">0</span> Dec <span class="m">11</span> <span class="m">16</span>:21 user -&gt; user:<span class="o">[</span><span class="m">4026531837</span><span class="o">]</span>
<a id="__codelineno-5-11" name="__codelineno-5-11"></a><a href="#__codelineno-5-11"><span class="linenos" data-linenos="11 "></span></a>lrwxrwxrwx <span class="m">1</span> root root <span class="m">0</span> Dec <span class="m">11</span> <span class="m">16</span>:21 uts -&gt; uts:<span class="o">[</span><span class="m">4026533017</span><span class="o">]</span>
</code></pre></div>
<ul>
<li>首先查找到容器 id</li>
<li>根据容器id查找容器对应的 pid</li>
<li>根据 pid，查找 /proc/{pid}/ns 下的命名空间</li>
</ul>
<blockquote>
<p>从结果看该容器对应6个命名空间, 类型不重复, 正好验证了我们之前的结论 “一个容器拥有一组命名空间, 即 Mount1、UTS1、IPC1、PID1、Network1、User1组合”。</p>
</blockquote>
<ul>
<li><a href="https://blog.csdn.net/weixin_42346693/article/details/116865576">参考 1: 关于 docker ns 运维操作</a></li>
<li><a href="https://zsnmwy.notion.site/How-Container-To-Use-Host-Kernel-537f533d1d94471a8e881605030ea4a9#e0eec90df25d453eb01131ffcdf2f61c">参考 2: 图解，既然容器是共享内核的，那为啥创建容器时还要弄个ubuntu/centos镜像？</a></li>
</ul>
<h2 id="2-docker-containerd-ctrrunc">2. 第二部分: 关于 docker 与 containerd 及 ctr、runc 命令关联<a class="headerlink" href="#2-docker-containerd-ctrrunc" title="Permanent link">&para;</a></h2>
<h3 id="21-docker-ctr-crictl">2.1 关于 <code>docker / ctr / crictl</code> 命令行对比 (示例)<a class="headerlink" href="#21-docker-ctr-crictl" title="Permanent link">&para;</a></h3>
<table>
<thead>
<tr>
<th>docker</th>
<th>ctr</th>
<th>crictl</th>
</tr>
</thead>
<tbody>
<tr>
<td>docker version</td>
<td>ctr version</td>
<td>crictl version</td>
</tr>
<tr>
<td>docker images</td>
<td>ctr -n k8s.io images ls</td>
<td>crictl img</td>
</tr>
<tr>
<td>docker pull nginx:latest</td>
<td>ctr i pull docker.io/library/nginx:latest</td>
<td>crictl pull docker.io/library/redis</td>
</tr>
<tr>
<td>docker push registry.cn-shenzhen.aliyuncs.com/wl4g-k8s/pause:3.2</td>
<td>ctr -n k8s.io images push --user myuser1:mypassword1 registry.cn-shenzhen.aliyuncs.com/wl4g-k8s/pause:3.2 k8s.gcr.io/pause:3.2</td>
<td></td>
</tr>
<tr>
<td>docker run -d –name nginx-name nginx:latest</td>
<td>ctr run -d docker.io/library/nginx:latest nginx-name</td>
<td>crictl run [command options] container-config.[json yaml] pod-config.[json yaml]</td>
</tr>
<tr>
<td>docker ps</td>
<td>ctr c ls / ctr t ls</td>
<td>crictl ps</td>
</tr>
<tr>
<td>docker inspect nginx-name</td>
<td>ctr c info nginx-name</td>
<td>crictl inspect</td>
</tr>
<tr>
<td>docker stop nginx-name</td>
<td>ctr t kill nginx-name</td>
<td>crictl stop</td>
</tr>
<tr>
<td>docker start nginx-name</td>
<td></td>
<td>crictl start</td>
</tr>
<tr>
<td>docker rm nginx-name</td>
<td>ctr c rm nginx-name</td>
<td></td>
</tr>
<tr>
<td>docker exec -it nginx-name bash</td>
<td>ctr t exec -t –exec-id=”foo” nginx-name sh</td>
<td>crictl exec -i -t [containerId] ls</td>
</tr>
<tr>
<td>docker logs -f --tail 10 wordpress</td>
<td></td>
<td>crictl logs --tail=10 [containerId]</td>
</tr>
</tbody>
</table>
<ul>
<li><a href="https://github.com/containerd/cri/blob/master/docs/crictl.md">containerd 官方文档 crictl 用法</a></li>
<li><a href="https://blog.csdn.net/alex_yangchuansheng/article/details/111306237">containerd 的前世今生和保姆级入门教程(有意思)</a></li>
<li><a href="https://www.sohu.com/a/233247128_198222">k8s 与 containerd+docker 技术演进</a></li>
</ul>
<h3 id="22-docker-containerd-runc">2.2 查看 docker / containerd / runc 等调用关系<a class="headerlink" href="#22-docker-containerd-runc" title="Permanent link">&para;</a></h3>
<ul>
<li>
<p>docker  --(rest)--&gt;  dockerd  --(grpc/ipc)--&gt;  containerd  --(ipc)--&gt;  containerd-shim-runc-v2-  --(ipc)--&gt;  runc (真正管理 namespaces/cgroups 等)</p>
</li>
<li>
<p>验证:</p>
</li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-6-1" name="__codelineno-6-1"></a><a href="#__codelineno-6-1"><span class="linenos" data-linenos=" 1 "></span></a><span class="c1"># I. 在宿主机上查看相关进程</span>
<a id="__codelineno-6-2" name="__codelineno-6-2"></a><a href="#__codelineno-6-2"><span class="linenos" data-linenos=" 2 "></span></a>&gt; ps -ef <span class="p">|</span> grep container
<a id="__codelineno-6-3" name="__codelineno-6-3"></a><a href="#__codelineno-6-3"><span class="linenos" data-linenos=" 3 "></span></a>root         <span class="m">954</span>       <span class="m">1</span>  <span class="m">0</span> Sep30 ?        <span class="m">00</span>:05:22 /usr/bin/containerd
<a id="__codelineno-6-4" name="__codelineno-6-4"></a><a href="#__codelineno-6-4"><span class="linenos" data-linenos=" 4 "></span></a>root        <span class="m">1188</span>       <span class="m">1</span>  <span class="m">0</span> Sep30 ?        <span class="m">00</span>:01:42 /usr/bin/dockerd -H fd:// --containerd<span class="o">=</span>/run/containerd/containerd.sock
<a id="__codelineno-6-5" name="__codelineno-6-5"></a><a href="#__codelineno-6-5"><span class="linenos" data-linenos=" 5 "></span></a>root        <span class="m">1572</span>    <span class="m">1188</span>  <span class="m">0</span> Sep30 ?        <span class="m">00</span>:00:01 /usr/bin/docker-proxy -proto tcp -host-ip <span class="m">0</span>.0.0.0 -host-port <span class="m">10080</span> -container-ip <span class="m">172</span>.17.0.2 -container-port <span class="m">80</span>
<a id="__codelineno-6-6" name="__codelineno-6-6"></a><a href="#__codelineno-6-6"><span class="linenos" data-linenos=" 6 "></span></a>root        <span class="m">1577</span>    <span class="m">1188</span>  <span class="m">0</span> Sep30 ?        <span class="m">00</span>:00:01 /usr/bin/docker-proxy -proto tcp -host-ip :: -host-port <span class="m">10080</span> -container-ip <span class="m">172</span>.17.0.2 -container-port <span class="m">80</span>
<a id="__codelineno-6-7" name="__codelineno-6-7"></a><a href="#__codelineno-6-7"><span class="linenos" data-linenos=" 7 "></span></a>root        <span class="m">1588</span>       <span class="m">1</span>  <span class="m">0</span> Sep30 ?        <span class="m">00</span>:00:33 /usr/lib/docker-current/containerd-shim-runc-v2 -namespace moby -id aefcf5a28fb3db7057ca1b59b489255024e333eedb497058e5163a109ea2cbc9 -address /run/containerd/containerd.sock
<a id="__codelineno-6-8" name="__codelineno-6-8"></a><a href="#__codelineno-6-8"><span class="linenos" data-linenos=" 8 "></span></a>root     <span class="m">1685964</span> <span class="m">1675561</span>  <span class="m">0</span> <span class="m">18</span>:19 pts/0    <span class="m">00</span>:00:00 grep --color<span class="o">=</span>auto container
<a id="__codelineno-6-9" name="__codelineno-6-9"></a><a href="#__codelineno-6-9"><span class="linenos" data-linenos=" 9 "></span></a>
<a id="__codelineno-6-10" name="__codelineno-6-10"></a><a href="#__codelineno-6-10"><span class="linenos" data-linenos="10 "></span></a><span class="c1"># II. 使用 docker 查看容器列表</span>
<a id="__codelineno-6-11" name="__codelineno-6-11"></a><a href="#__codelineno-6-11"><span class="linenos" data-linenos="11 "></span></a>&gt; docker ps <span class="p">|</span> head
<a id="__codelineno-6-12" name="__codelineno-6-12"></a><a href="#__codelineno-6-12"><span class="linenos" data-linenos="12 "></span></a>CONTAINER ID   IMAGE              COMMAND                  CREATED        STATUS       PORTS                                     NAMES
<a id="__codelineno-6-13" name="__codelineno-6-13"></a><a href="#__codelineno-6-13"><span class="linenos" data-linenos="13 "></span></a>aefcf5a28fb3   wordpress:latest   <span class="s2">&quot;docker-entrypoint.s…&quot;</span>   <span class="m">5</span> months ago   Up <span class="m">12</span> days   <span class="m">0</span>.0.0.0:10080-&gt;80/tcp, :::10080-&gt;80/tcp   wordpress
<a id="__codelineno-6-14" name="__codelineno-6-14"></a><a href="#__codelineno-6-14"><span class="linenos" data-linenos="14 "></span></a>
<a id="__codelineno-6-15" name="__codelineno-6-15"></a><a href="#__codelineno-6-15"><span class="linenos" data-linenos="15 "></span></a><span class="c1"># III. 使用 ctr 查看容器列表</span>
<a id="__codelineno-6-16" name="__codelineno-6-16"></a><a href="#__codelineno-6-16"><span class="linenos" data-linenos="16 "></span></a>&gt; ctr -n moby c ls <span class="p">|</span> head
<a id="__codelineno-6-17" name="__codelineno-6-17"></a><a href="#__codelineno-6-17"><span class="linenos" data-linenos="17 "></span></a>CONTAINER                                                           IMAGE    RUNTIME
<a id="__codelineno-6-18" name="__codelineno-6-18"></a><a href="#__codelineno-6-18"><span class="linenos" data-linenos="18 "></span></a>aefcf5a28fb3db7057ca1b59b489255024e333eedb497058e5163a109ea2cbc9    -        io.containerd.runc.v2
<a id="__codelineno-6-19" name="__codelineno-6-19"></a><a href="#__codelineno-6-19"><span class="linenos" data-linenos="19 "></span></a>
<a id="__codelineno-6-20" name="__codelineno-6-20"></a><a href="#__codelineno-6-20"><span class="linenos" data-linenos="20 "></span></a><span class="c1"># IV. 使用 runc 查看容器列表</span>
<a id="__codelineno-6-21" name="__codelineno-6-21"></a><a href="#__codelineno-6-21"><span class="linenos" data-linenos="21 "></span></a>&gt; runc --root /run/docker/runtime-runc/moby/ list <span class="p">|</span> head
<a id="__codelineno-6-22" name="__codelineno-6-22"></a><a href="#__codelineno-6-22"><span class="linenos" data-linenos="22 "></span></a>ID                                                                 PID         STATUS      BUNDLE                                                                                                                CREATED                          OWNER
<a id="__codelineno-6-23" name="__codelineno-6-23"></a><a href="#__codelineno-6-23"><span class="linenos" data-linenos="23 "></span></a>aefcf5a28fb3db7057ca1b59b489255024e333eedb497058e5163a109ea2cbc9   <span class="m">1609</span>        running     /run/containerd/io.containerd.runtime.v2.task/moby/aefcf5a28fb3db7057ca1b59b489255024e333eedb497058e5163a109ea2cbc9   <span class="m">2021</span>-09-30T09:34:23.492183284Z   root
<a id="__codelineno-6-24" name="__codelineno-6-24"></a><a href="#__codelineno-6-24"><span class="linenos" data-linenos="24 "></span></a>
<a id="__codelineno-6-25" name="__codelineno-6-25"></a><a href="#__codelineno-6-25"><span class="linenos" data-linenos="25 "></span></a><span class="c1"># V. 使用 docker 查看镜像列表</span>
<a id="__codelineno-6-26" name="__codelineno-6-26"></a><a href="#__codelineno-6-26"><span class="linenos" data-linenos="26 "></span></a>&gt; docker images <span class="p">|</span> head
<a id="__codelineno-6-27" name="__codelineno-6-27"></a><a href="#__codelineno-6-27"><span class="linenos" data-linenos="27 "></span></a>REPOSITORY                           TAG                               IMAGE ID       CREATED         SIZE
<a id="__codelineno-6-28" name="__codelineno-6-28"></a><a href="#__codelineno-6-28"><span class="linenos" data-linenos="28 "></span></a>sonatype/nexus3                      latest                            a0d390a200d2   <span class="m">7</span> weeks ago     655MB
<a id="__codelineno-6-29" name="__codelineno-6-29"></a><a href="#__codelineno-6-29"><span class="linenos" data-linenos="29 "></span></a>k8s.gcr.io/kube-apiserver            v1.21.3                           3d174f00aa39   <span class="m">2</span> months ago    126MB
<a id="__codelineno-6-30" name="__codelineno-6-30"></a><a href="#__codelineno-6-30"><span class="linenos" data-linenos="30 "></span></a>k8s.gcr.io/kube-scheduler            v1.21.3                           6be0dc1302e3   <span class="m">2</span> months ago    <span class="m">50</span>.6MB
<a id="__codelineno-6-31" name="__codelineno-6-31"></a><a href="#__codelineno-6-31"><span class="linenos" data-linenos="31 "></span></a>k8s.gcr.io/kube-proxy                v1.21.3                           adb2816ea823   <span class="m">2</span> months ago    103MB
<a id="__codelineno-6-32" name="__codelineno-6-32"></a><a href="#__codelineno-6-32"><span class="linenos" data-linenos="32 "></span></a>k8s.gcr.io/kube-controller-manager   v1.21.3                           bc2bb319a703   <span class="m">2</span> months ago    120MB
<a id="__codelineno-6-33" name="__codelineno-6-33"></a><a href="#__codelineno-6-33"><span class="linenos" data-linenos="33 "></span></a>gcr.io/istio-testing/build-tools     release-1.9-2021-07-13T16-45-56   82ed67ca3328   <span class="m">3</span> months ago    <span class="m">3</span>.24GB
<a id="__codelineno-6-34" name="__codelineno-6-34"></a><a href="#__codelineno-6-34"><span class="linenos" data-linenos="34 "></span></a>wordpress                            latest                            c01290f258b3   <span class="m">5</span> months ago    550MB
<a id="__codelineno-6-35" name="__codelineno-6-35"></a><a href="#__codelineno-6-35"><span class="linenos" data-linenos="35 "></span></a>nextcloud                            latest                            6d746b3f79cd   <span class="m">6</span> months ago    868MB
<a id="__codelineno-6-36" name="__codelineno-6-36"></a><a href="#__codelineno-6-36"><span class="linenos" data-linenos="36 "></span></a>gitlab/gitlab-ce                     latest                            9b80fc55d250   <span class="m">6</span> months ago    <span class="m">2</span>.2GB
<a id="__codelineno-6-37" name="__codelineno-6-37"></a><a href="#__codelineno-6-37"><span class="linenos" data-linenos="37 "></span></a>
<a id="__codelineno-6-38" name="__codelineno-6-38"></a><a href="#__codelineno-6-38"><span class="linenos" data-linenos="38 "></span></a><span class="c1"># VI. 使用 ctr 查看镜像列表</span>
<a id="__codelineno-6-39" name="__codelineno-6-39"></a><a href="#__codelineno-6-39"><span class="linenos" data-linenos="39 "></span></a><span class="c1"># 注: 默认这里显示不了docker镜像，但如果通过 ctr 导入 docker 导出的镜像是可以的，原因是他们存放镜像的目录不同</span>
<a id="__codelineno-6-40" name="__codelineno-6-40"></a><a href="#__codelineno-6-40"><span class="linenos" data-linenos="40 "></span></a>&gt; ctr -n moby i ls
<a id="__codelineno-6-41" name="__codelineno-6-41"></a><a href="#__codelineno-6-41"><span class="linenos" data-linenos="41 "></span></a>REF TYPE DIGEST SIZE PLATFORMS LABELS
<a id="__codelineno-6-42" name="__codelineno-6-42"></a><a href="#__codelineno-6-42"><span class="linenos" data-linenos="42 "></span></a>
<a id="__codelineno-6-43" name="__codelineno-6-43"></a><a href="#__codelineno-6-43"><span class="linenos" data-linenos="43 "></span></a><span class="c1"># VII. 使用 find 找到 docker 中 k8s.gcr.io/kube-apiserver 镜像</span>
<a id="__codelineno-6-44" name="__codelineno-6-44"></a><a href="#__codelineno-6-44"><span class="linenos" data-linenos="44 "></span></a>&gt; find /var/lib/docker/image/overlay2/imagedb/content/sha256/ <span class="p">|</span> grep 3d174f00aa39
<a id="__codelineno-6-45" name="__codelineno-6-45"></a><a href="#__codelineno-6-45"><span class="linenos" data-linenos="45 "></span></a>/var/lib/docker/image/overlay2/imagedb/content/sha256/3d174f00aa39eb8552a9596610d87ae90e0ad51ad5282bd5dae421ca7d4a0b80
<a id="__codelineno-6-46" name="__codelineno-6-46"></a><a href="#__codelineno-6-46"><span class="linenos" data-linenos="46 "></span></a>
<a id="__codelineno-6-47" name="__codelineno-6-47"></a><a href="#__codelineno-6-47"><span class="linenos" data-linenos="47 "></span></a><span class="c1"># VII. 查看 containerd 相关进程树</span>
<a id="__codelineno-6-48" name="__codelineno-6-48"></a><a href="#__codelineno-6-48"><span class="linenos" data-linenos="48 "></span></a>&gt; systemctl status <span class="p">|</span> grep -A <span class="m">5</span> -B <span class="m">3</span> containerd
<a id="__codelineno-6-49" name="__codelineno-6-49"></a><a href="#__codelineno-6-49"><span class="linenos" data-linenos="49 "></span></a>...
<a id="__codelineno-6-50" name="__codelineno-6-50"></a><a href="#__codelineno-6-50"><span class="linenos" data-linenos="50 "></span></a>           ├─init.scope
<a id="__codelineno-6-51" name="__codelineno-6-51"></a><a href="#__codelineno-6-51"><span class="linenos" data-linenos="51 "></span></a>           │ └─1 /usr/lib/systemd/systemd --switched-root --system --deserialize <span class="m">18</span>
<a id="__codelineno-6-52" name="__codelineno-6-52"></a><a href="#__codelineno-6-52"><span class="linenos" data-linenos="52 "></span></a>           └─system.slice
<a id="__codelineno-6-53" name="__codelineno-6-53"></a><a href="#__codelineno-6-53"><span class="linenos" data-linenos="53 "></span></a>             ├─rngd.service
<a id="__codelineno-6-54" name="__codelineno-6-54"></a><a href="#__codelineno-6-54"><span class="linenos" data-linenos="54 "></span></a>...
<a id="__codelineno-6-55" name="__codelineno-6-55"></a><a href="#__codelineno-6-55"><span class="linenos" data-linenos="55 "></span></a>             │ └─755 /usr/bin/lsmd -d
<a id="__codelineno-6-56" name="__codelineno-6-56"></a><a href="#__codelineno-6-56"><span class="linenos" data-linenos="56 "></span></a>             ├─coredns.service
<a id="__codelineno-6-57" name="__codelineno-6-57"></a><a href="#__codelineno-6-57"><span class="linenos" data-linenos="57 "></span></a>             │ └─925 /opt/apps/coredns-1.7.0/coredns_linux_amd64_v1.7.0 -conf /opt/apps/coredns-1.7.0/Corefile
<a id="__codelineno-6-58" name="__codelineno-6-58"></a><a href="#__codelineno-6-58"><span class="linenos" data-linenos="58 "></span></a>             ├─containerd.service
<a id="__codelineno-6-59" name="__codelineno-6-59"></a><a href="#__codelineno-6-59"><span class="linenos" data-linenos="59 "></span></a>             │ ├─ <span class="m">954</span> /usr/bin/containerd
<a id="__codelineno-6-60" name="__codelineno-6-60"></a><a href="#__codelineno-6-60"><span class="linenos" data-linenos="60 "></span></a>             │ └─1588 /usr/lib/docker-current/containerd-shim-runc-v2 -namespace moby -id aefcf5a28fb3db7057ca1b59b489255024e333eedb497058e5163a109ea2cbc9 -address /run/containerd/containerd.sock
<a id="__codelineno-6-61" name="__codelineno-6-61"></a><a href="#__codelineno-6-61"><span class="linenos" data-linenos="61 "></span></a>             ├─nginx.service
<a id="__codelineno-6-62" name="__codelineno-6-62"></a><a href="#__codelineno-6-62"><span class="linenos" data-linenos="62 "></span></a>...
<a id="__codelineno-6-63" name="__codelineno-6-63"></a><a href="#__codelineno-6-63"><span class="linenos" data-linenos="63 "></span></a>             │ ├─1259 nginx: worker process
<a id="__codelineno-6-64" name="__codelineno-6-64"></a><a href="#__codelineno-6-64"><span class="linenos" data-linenos="64 "></span></a>             │ └─1260 nginx: worker process
<a id="__codelineno-6-65" name="__codelineno-6-65"></a><a href="#__codelineno-6-65"><span class="linenos" data-linenos="65 "></span></a>             ├─docker.service
<a id="__codelineno-6-66" name="__codelineno-6-66"></a><a href="#__codelineno-6-66"><span class="linenos" data-linenos="66 "></span></a>             │ ├─1188 /usr/bin/dockerd -H fd:// --containerd<span class="o">=</span>/run/containerd/containerd.sock
<a id="__codelineno-6-67" name="__codelineno-6-67"></a><a href="#__codelineno-6-67"><span class="linenos" data-linenos="67 "></span></a>             │ ├─1572 /usr/bin/docker-proxy -proto tcp -host-ip <span class="m">0</span>.0.0.0 -host-port <span class="m">10080</span> -container-ip <span class="m">172</span>.17.0.2 -container-port <span class="m">80</span>
<a id="__codelineno-6-68" name="__codelineno-6-68"></a><a href="#__codelineno-6-68"><span class="linenos" data-linenos="68 "></span></a>             │ └─1577 /usr/bin/docker-proxy -proto tcp -host-ip :: -host-port <span class="m">10080</span> -container-ip <span class="m">172</span>.17.0.2 -container-port <span class="m">80</span>
<a id="__codelineno-6-69" name="__codelineno-6-69"></a><a href="#__codelineno-6-69"><span class="linenos" data-linenos="69 "></span></a>...
</code></pre></div>
<p>通过以上分析可知，docker 的容器最终是由 containerd 调用的  containerd-shim-runc-v2 再调用的  runc，而 containerd-shim-runc-v2 的父进程为 1，所以可以在线升级 containerd 也不会影响运行中的容器。</p>

              
            </article>
          </div>
        </div>
        
      </main>
      
        <footer class="md-footer">
  
  <div class="md-footer-meta md-typeset">
    <div class="md-footer-meta__inner md-grid">
      <div class="md-copyright">
  
  
    Made with
    <a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
      Material for MkDocs
    </a>
  
</div>
      
    </div>
  </div>
</footer>
      
    </div>
    <div class="md-dialog" data-md-component="dialog">
      <div class="md-dialog__inner md-typeset"></div>
    </div>
    <script id="__config" type="application/json">{"base": "../../../..", "features": ["search.suggest", "search.highlight", "navigation.tabs", "navigation.expand", "toc.follow", "toc.integrate"], "search": "../../../../assets/javascripts/workers/search.5e67fbfe.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.config.lang": "en", "search.config.pipeline": "trimmer, stopWordFilter", "search.config.separator": "[\\s\\-]+", "search.placeholder": "Search", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version.title": "Select version"}, "version": {"default": "latest", "provider": "mike"}}</script>
    
    
      <script src="../../../../assets/javascripts/bundle.c44cc438.min.js"></script>
      
        <script src="../../../../static/js/util.js"></script>
      
    
  </body>
</html>